TP-Link Easy Smart Switch security question

JKnott · Nov 11, 2017, 8:34 PM

Were you able to see the port assignment changed in step# 5?

No, there was very little recognizable text in the hex editor. I did not see the word "Default", as shown in lexxai's post.

The only thing I saw strange was that the switch's IP address is a member of all vlans. If I were to change my PC's IP address to the same subnet of the switch, I could communicate to it on non-native vlan, which is kinda weird.

On managed switches I've worked on, there was a specific management interface, which was assigned an IP address. I've also set up networks where the management interface was on a separate VLAN.

thuety · Nov 11, 2017, 9:50 PM

@JKnott:

The only thing I saw strange was that the switch's IP address is a member of all vlans. If I were to change my PC's IP address to the same subnet of the switch, I could communicate to it on non-native vlan, which is kinda weird.

On managed switches I've worked on, there was a specific management interface, which was assigned an IP address. I've also set up networks where the management interface was on a separate VLAN.

Even after setting the VLAN 1 membership to port 8 only… I can still connect a client to any switch port, set the IP to the same subnet and then access the switch web login.
So the VLAN 1 has no relevance for web admin access... I guess we can kill all VLAN 1 membership with the HEX hack..!?

stephenw10 · Nov 12, 2017, 2:44 PM

Hmm, well this is interesting. Implies it's a gui limitation only.

The exact string Default_VLAN does not appear in the config from a TL-SG1016DE v1. Not quite the same as the v2 either. Some experimentation needed….

Steve

![Config(1).cfg - GHex_311.png](/public/imported_attachments/1/Config(1).cfg - GHex_311.png)
![Config(1).cfg - GHex_311.png_thumb](/public/imported_attachments/1/Config(1).cfg - GHex_311.png_thumb)

tpham3783 · Nov 12, 2017, 3:05 PM

@thuety:

Even after setting the VLAN 1 membership to port 8 only… I can still connect a client to any switch port, set the IP to the same subnet and then access the switch web login.
So the VLAN 1 has no relevance for web admin access... I guess we can kill all VLAN 1 membership with the HEX hack..!?

I saw that too. It looks like the switch (management IP) is a member of all vlans, and that the gui an be accessed from any access-ports. However, the gui can not be accessed on a trunk port (tagged port), unless you configure another vlan w/ the trunk port configured as untagged port. Attached is a picture of my improved config where I ended up removing all ports from vlan1.

Although I can access the swith's management interface on any access-ports (untagged ports), I can not access PCs that belong on another VLAN. Would you please confirm that's what you're seeing too? thanks

tpham3783 · Nov 12, 2017, 3:23 PM

@stephenw10:

Hmm, well this is interesting. Implies it's a gui limitation only.

The exact string Default_VLAN does not appear in the config from a TL-SG1016DE v1. Not quite the same as the v2 either. Some experimentation needed….

Steve

yeah, keep on working at it. I'd create one vlan (ie. vlan 2) with all ports as untagged member, save the config. Then generate a second config with the last port removed from the vlan. Diff the two files ie:

hexdump -C config.cfg.original > /tmp/config.cfg.original.hex # vlan2 w/ all ports
hexdump -C config.cfg > /tmp/config.cfg.hex # vlan2 w/ all ports but the last port

diff -urN /tmp/config.cfg.original.hex /tmp/config.cfg.hex

Then you would have a good idea where the vlan config token is set.

n3by · Nov 12, 2017, 3:55 PM

Sg108E: at least in GUI I deleted default vlan 1.

![2017-11-12 16.50.09.jpg](/public/imported_attachments/1/2017-11-12 16.50.09.jpg)
![2017-11-12 16.50.09.jpg_thumb](/public/imported_attachments/1/2017-11-12 16.50.09.jpg_thumb)

stephenw10 · Nov 12, 2017, 3:56 PM

Seems to have some file validation/checksum that prevents uploading a modified file…. no one else seeing that? I'd be surprised if they actually removed that from the v2.

Steve

n3by · Nov 12, 2017, 4:02 PM

Tested and NO checksum for:
Firmware Version 1.0.2 Build 20160526 Rel.34615
Hardware Version TL-SG108E 2.0

stephenw10 · Nov 12, 2017, 4:21 PM

Hmm, using:

Firmware Version 1.0.1 Build 20131023 Rel.33236
Hardware Version TL-SG1016DE 1.0

Refuses any edited config

Invalid config file! Please double check!

Yet lexxai seems to be good on his 1016DEv2….

Steve

jahonix · Nov 12, 2017, 4:57 PM

Check if there's a checksum or such yourself?

a) save config_1
b) change something small like hostname one character from lower to upper case. Don't change length.
c) save config_2
d) diff config_1 and config_2

e) report result.

stephenw10 · Nov 12, 2017, 6:19 PM

Speculating….

The things that change other than the config change are the password seems to be re-hashed and stored twice. And at the begging of the file there is a 16bit value that changes. I'd bet that's a 16bit checksum but of what exactly I'm not sure. Or what algorithm... Not found a match so far.

Steve

JKnott · Nov 12, 2017, 6:45 PM

I can not access PCs that belong on another VLAN. Would you please confirm that's what you're seeing too?

That's how VLANs are supposed to work, as though each VLAN is on a separate switch. It's the accessing the management from any VLAN that's messed up. It should be possible to have the management on it's own VLAN, unreachable from any other.

tpham3783 · Nov 12, 2017, 11:44 PM

@ecfx:

Sg108E: at least in GUI I deleted default vlan 1.

Good find!

I've always thought they implemented a front-end logic (webpage) for first vlan to be non-editable; hence you must have the first vlan as a place holder!

Thanks!

thuety · Nov 15, 2017, 7:21 AM

@ecfx:

Sg108E: at least in GUI I deleted default vlan 1.

Thanks, didn't have the courage to try this ;)

I'm guessing the hex 01 is VLAN 1.

n3by · Nov 15, 2017, 7:27 AM

yes, and this changes seem to persist if you add-delete-change other vlans.

If I could figure how to set 2 "true" - trunk ports will be great.

p.s.
After that I made yesterday other try that soft bricked the switch but can be fix easy with hard button reset.

lexxai · Nov 17, 2017, 7:33 PM

@stephenw10:

Hmm, using:

Firmware Version 1.0.1 Build 20131023 Rel.33236
Hardware Version TL-SG1016DE 1.0

Refuses any edited config

Invalid config file! Please double check!

Yet lexxai seems to be good on his 1016DEv2….

Steve

I have same troubles with return to device changed configuration file…

juanchopablo · Nov 19, 2017, 5:31 PM

I have 2 108v2, what would I have to edit if I want to remove vlan 1 just from ports 7 and 8?

Thanks,

stephenw10 · Nov 20, 2017, 4:49 PM

@lexxai:

I have same troubles with return to device changed configuration file…

Hmm, damn.
What is that checksum I wonder….

Steve

bilbo · Dec 12, 2017, 9:06 PM

Is this vlan 1 issue the reason i see tplink broadcast traffic on all ports? I have the five port.

Edit: I did the hex hack and removed all ports from the vlan but still see this broadcast, any pointers on stopping it.

edit: scrap that, it appears to have been the loop detection setting! Nice to get rid of the default vlan though.

![Screenshot from 2017-12-12 23-35-26.png](/public/imported_attachments/1/Screenshot from 2017-12-12 23-35-26.png)
![Screenshot from 2017-12-12 23-35-26.png_thumb](/public/imported_attachments/1/Screenshot from 2017-12-12 23-35-26.png_thumb)

tpham3783 · Dec 22, 2017, 4:40 PM

Hi all,

It looks like tplink is going to fix the issue related to unlinking vlan1 according to this thread http://forum.tp-link.com/showthread.php?96245-TL-SG-108E-V2-VLAN-1-tagging#post226139

They will have a beta firmware to test in a week or two. I am glad that the company has regnonized that it is a bug and is taking corrective action.